{
  "alert_name": "Splunk alert: payments-service NullPointerException spike",
  "pipeline_name": "payments_service",
  "severity": "critical",
  "alert_source": "splunk",
  "message": "Splunk detected 847 NullPointerExceptions in the last 15 minutes",
  "error_message": "NullPointerException in com.corp.payments.PaymentProcessor.process",
  "commonAnnotations": {
    "summary": "payments-service is logging repeated NullPointerExceptions in production",
    "splunk_query": "index=prod sourcetype=app_logs \"NullPointerException\" | head 50",
    "service": "payments-service",
    "environment": "production"
  }
}